TPRM & FINRA Compliance: Regulatory Notice 21-29 | UpGuard

This article analyzes FINRA Regulatory Notice 21-29 and related requirements—FINRA Rules 3110 and 4370 and SEC Regulation S-P Rule 30—highlighting the growing need for robust third-party risk management in the broker-dealer sector. It recommends TPRM practices such as vendor due diligence, periodic risk assessments, continuous security monitoring, and aligning business continuity planning with vendor risk, underscoring member accountability for third-party actions and prior enforcement examples. The piece concludes by promoting a TPRM solution (UpGuard Vendor Risk) to help operationalize these controls and meet compliance expectations.